tracelens-analysis-orchestrator

This module is not overtly malicious in itself, but it creates a high-risk supply-chain execution pathway: it downloads and editable-installs a repository from an environment-controlled URL, extracts a tarball using `tar.extractall` without path validation, and executes the repository’s evaluation scripts via subprocess. If an attacker can influence TRACELENS_* environment variables or the cloned repository/tarball content, the most likely impact is arbitrary code execution and/or filesystem manipulation (including possible tar path traversal/symlink escape).